CVE-2026-92561 in Booking Calendar Plugin
Summary
by MITRE • 09/18/2026
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The nonce check is bypassed by default because the 'booking_is_nonce_at_front_end' option ships disabled, allowing unauthenticated requests to reach the vulnerable sink without any verification.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The Booking Calendar plugin for WordPress contains a critical reflected cross-site scripting vulnerability affecting all versions up to and including 11.8.2. This flaw stems from insufficient input sanitization and output escaping mechanisms within the application code, specifically when processing data passed through the options parameter. The nature of this vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that are subsequently rendered in a victim's browser. For the attack to be successful, the attacker must trick a user into performing an action such as clicking on a maliciously crafted link containing the injected script payload.
The severity of this issue is significantly amplified by the default configuration settings regarding nonce verification. The plugin ships with the booking_is_nonce_at_front_end option disabled by default. This misconfiguration means that unauthenticated requests can reach the vulnerable sink without any cryptographic verification or authentication checks. Consequently, an attacker does not need to bypass complex security controls or obtain valid session tokens; they only need to lure a victim into accessing the crafted URL. Once accessed, the browser executes the injected JavaScript in the context of the website, potentially allowing the attacker to steal cookies, hijack user sessions, deface the site, or redirect users to malicious domains.
From an industry standard perspective, this vulnerability is classified under CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific vector involves reflected input where data sent via HTTP parameters is echoed back without proper encoding. In terms of the MITRE ATT&CK framework, this aligns with techniques related to Client-side Injection and potentially Account Manipulation if session tokens are harvested. Attackers often leverage such vulnerabilities in phishing campaigns or drive-by download scenarios to compromise user accounts associated with WordPress sites running vulnerable plugins.
Mitigation strategies should focus on immediate remediation and defensive configuration changes. The most effective solution is to update the Booking Calendar plugin to version 12.0.0 or later, where these input handling issues have been addressed by developers through proper sanitization of incoming data and consistent output escaping using WordPress functions like esc_html or wp_kses_post. For organizations unable to patch immediately due to compatibility concerns, disabling the affected functionality if not required is a viable temporary measure. Additionally administrators should ensure that security plugins are configured to detect and block common XSS payloads in query parameters. Regular auditing of plugin configurations against secure defaults can prevent similar issues arising from disabled nonce checks or other authentication bypasses in future updates.